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ABSTRACT 



A key agreement protocol for preventing key-share attacks wherein a method is provided 
for establishing a common shared key between a pair of correspondents in a station-to- 
station protocol by exchanging messages between the correspondents and including 
identification information in said messages, said information being identifiable to one or 
other of said correspondents to thereby establish said common key. 
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A Method For Preventing Key-Share Attacks 

This invention relates to cryptographic systems and in particular, to improvements 
in key agreement protocols for preventing key-share attacks thereon. 

BACKGROUND OF THE INVENTION 

Key establishment is the process by which two (or more) entities establish a shared 
secret key. 

The key is subsequently used to achieve some cryptographic goal, such as 
confidentiality or data integrity. Ideally, the established key should have precisely the same 
attributes as a key established face-to-face it should be distributed uniformly at random 
from the key space, and no unauthorized (and computationally bounded) entity should 
learn anything about the key. 

Broadly speaking, there are two kinds of key establishment protocols: key transport 
protocols in which a key is created by one entity and securely transmitted to the second 
entity, and key agreement protocols in which both parties contribute information which 
jointly establish the shared secret key. 

Let A and B be two honest entities, i.e., legitimate entities who execute the steps of 
a protocol correctly. Informally speaking, a key agreement protocol is said to provide 
implicit key authentication (of B to A) if entity A is assured that no other entity aside from 
a specifically identified second entity B can possibly learn the value of a particular secret 
key. Note that the property of implicit key authentication does not necessarily mean that A 
is assured of B actually possessing the key. A key agreement protocol which provides 
implicit key authentication to both participating entities is called an authenticated key 
agreement (AK) protocol. 

Informally speaking, a key agreement protocol is said to provide explicit key 
confirmation (of B to A) if entity A is assured that the second entity B has actually 
computed the agreed key. 



1 
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The protocol provides implicit key confirmation if A is assured that B can compute 
the agreed key. While explicit key confirmation appears to provide stronger assurances to 
A than implicit key confirmation (in particular, the former implies the latter), it is possible 
that, for all practical purposes, the assurances are in fact the same. This is because B may 
5 delete the key immediately after the explicit key confirmation process. 

If both implicit key authentication and (implicit or explicit) key confirmation (of B 
to A) are provided, then the key establishment protocol is said to provide explicit key 
authentication (of B to A). A key agreement protocol which provides explicit key 
authentication to both participating entities is called an authenticated key agreement with 

1 0 key confirmation (AKC) protocol. 

An unknown key-share (UKS) attack on an AK or AKC protocol is an attack 
whereby an entity A is coerced into sharing a key with an entity B without A's knowledge, 
i.e. when A believes the key is shared with some entity E * B . Notice that if an AK or 
AKC protocol succumbs to a UKS attack, then this does not contradict the implicit key 

1 5 authentication property of the protocol. By definition, the provision of implicit key 
authentication is only considered in the case where A engages in the protocol with an 
honest entity (which E isn't). 

The station-to-station (STS) protocol is a Diffie-Hellman-based AKC protocol that 
purports to provide both (mutual) implicit key authentication and (mutual) key 

20 confirmation, and additionally appears to possess desirable security attributes such as 

forward secrecy and key-compromise impersonation. There are two main variants of STS 
as described in W. Diffie et al., "Authentication and authenticated key exchanges", 
Designs, Codes and Cryptography, 2 (1992) 107-125. One in which key confirmation is 
provided by using the agreed key K in a MAC algorithm (STS-MAC), and another in 

25 which K is used in an encryption scheme (STS-ENC). STS-MAC is preferred over STS- 
ENC in many practical scenarios. Moreover, the use of encryption to provide key 
confirmation in STS-ENC is suspect - the goal of an encryption scheme is to provide 
confidentiality, rather than as an authentication mechanism for proving possession of a 
key. One advantage of STS-ENC over STS-MAC is that the former can facilitate the 

30 provision of anonymity. 
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Many protocols related to STS have appeared in the literature. It should be noted, 
however, that these protocols cannot be considered minor variants of STS. 

For the sake of clarity, notation used in the specification, is initially outlined as follows: 

5 

A, B Honest entities. 

E The adversary. 

Sa A's (private) signing key for a signature scheme S. 

P A A's (public) verification key for S. 

10 Sa(M) A's signature on message M. 

Cert A A's certificate containing A's name, A's public signature key PA, and 

possibly some other information. 
E K (M) Encryption of M using a symmetric-key encryption scheme with key K. 

MACic(M) Message authentication code of M under key K. 
15 G, a, n Diffie-Hellman parameters; oc is an element of prime order n in the finite 
group G. 

r A A's ephemeral Diffie-Hellman private key; 1 <> r A < n - 1 . 

K Ephemeral Diffie-Hellman shared secret; K = a' 4 ' 8 

20 The two STS variants are presented below. In both descriptions, A is called the 

initiator, while B is called the responder. 

STS-MAC protocol 

The STS-MAC protocols is depicted below. Initiator A selects a random secret integer r A , 
25 I < r A < n - 1 , and sends to B the message ( 1 ). Upon receiving (1),B selects a random 

secret integer r B ,1 < r B < n - 1 , computes the shared secret K = a r ** , and sends message 
(2) to A. 

Upon receiving (2), A uses Cert B to verify the authenticity of B's signing key P B , verifies 
B's signature on the message (a rB ,a rA ), computes the shared secret K, and verifies the 
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MAC on S B (a rB , <z rA ) A then sends message (3) to B. Upon receipt of (3), B uses Cert A 
to verify the authenticity of A's signing key PA, verifies A's signature on the message 
{a rA , a rB ) and verifies the MAC on S B (a rA ,a rB ) . If at any stage a check or verification 
performed by A or B fails, then that entity terminates the protocol run, and rejects. 

5 

(1) A^>B A, a rA 

(2) A^B Certe, a rB 9 (S B (a rB 9 a rA \A{AC K (S B (a r \a rA )) 

(3) A^B CertA, S Aa rA ,a rB ), MAC K (S A (<* rA .<*'*)) 

10 STS-ENC protocol 

The STS-ENC protocol is given below. For the sake of brevity, the checks that should be 
performed by A and B are henceforth omitted. 

(1) A^B A, a rA 

15 (2) A <- B Certe, a rB 9 E K (S B (a rB y a rA )) 

(3) A-+B Cert A) E K {S A (a rA , a rB )) 

In order to more clearly understand an unknown key-share (UKS) attack on a key 
agreement protocol, we consider a hypothetical scenario where a UKS attack can have 

20 damaging consequences. Suppose that A is a bank branch and B is an account holder. 
Certificates are issued by the bank headquarters and within each certificate is the account 
information of the holder. Suppose that the protocol for electronic deposit of funds is to 
exchange a key with a bank branch via an AKC protocol. At the conclusion of the protocol 
run, encrypted funds are deposited to the account number in the certificate. Suppose that no 

25 further authentication is done in the encrypted deposit message (which might be the case to 
save bandwidth). If the UKS attack mentioned above is successfully launched then the 
deposit will be made to E's account instead of B f s account. 



4 



CA 02241705 1998-09-21 



It is important to observe that a UKS attack on an AKC protocol is a much more 
serious consideration than a UKS attack on an AK protocol (which does not provide key 
confirmation). 

No key agreed in an AK protocol should be used without key confirmation. Indeed, 
5 some standards take the conservative approach of mandating key confirmation of keys 
agreed in an AK protocol. If appropriate key confirmation is subsequently provided, then 
the attempt at a UKS attack will be detected. For this reason, the above hypothetical 
scenario (in particular, the assumption that no further authentication is performed after 
termination of the key agreement protocol) is realistic if an AKC protocol is used (since 
10 key confirmation has already been provided), and unrealistic if an AK protocol is used 
(since key confirmation has not yet been provided). 

In a UKS attack against the responder, the adversary E registers A's public key PA as 
its own; i.e., P E = Pa- When A sends B message (I), E intercepts it and replaces the identity 
A with E. E then passes message (2) from B to A unchanged. Finally E intercepts message 
15 (3), and replaces Cert A with Cert E . Since P A = Pe, we have S A (a r \a rB ) = S E (a rA ,a rB ). 
Hence, B accepts the key K and believes that K is shared with E, while in fact it is shared 
with A. 

Note that E does not leani the value of K. The attack is depicted below. The notation 
Al^> B means that A transmitted a message intended for B, which was intercepted by the 
20 adversary and not delivered to B. 

{l)A\^B A,a rA 

{V)E-*B E,a rA 

(2) E^B Certa, a rB ,S 9 (a rB ,a' A ),MAC K (S 3 (a rB 9 a rA )) 
IS (2*) A^E C Q n B7 a r \S B (a r \a rA lMAC K (S 3 (a r \a rA )) 

(3) A\->B Cert A , S A {a rB ,a rA \MAC K (S A {a rB y a rA )) 
(3 1 ) E B Cert A) S A (a rB , a rA ), MA C K (S A (a rB ,a rA )) 
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10 



Entity E can similarly launch a UKS attack against the initiator A by registering B's 
public key PB as its own. The attack is depicted below. 

(1) A-+E A,a rA 
(l')£->5 A y a tA 

(2) A+-IB Ceita, a rB ,S B (a r \a rA \MAC K (S B (a rB ,0) 
(2') A<-E Certe, a rB 9 S B (a rB ,a rA ),MAC K (S B {a rB ,a' A )) 

(3) A^E Cert A , S A {a rB ,a' A \MAC K (S A (a rB ,a' A )) 
(3') E^B Cert A) S A {a rB ,a rA \MAC K (S A {a rB ,a rA )) 



In describing new on-line UKS attacks we make the following assumptions. First, 
we assume that the signature scheme S used in STS has the following duplicate-signature 
key selection property. Suppose that P A (A's public key), and A's signature sA on a 
message M are known. Then the adversary is able to select a key pair (P E ; S E ) with respect 
1 5 to which s A is also E's signature on the message M. 



Second, E is able to get its public key certified during a run of the STS protocol. 
This assumption is plausible, for instance, in situations where delays in the transmission of 
messages are normal, and where the CA is on-line. 
20 This new UKS attack against the responder is similar to the public key substitution 

attack against the responder as described earlier. After A sends message (3), E intercepts it 
and selects a key pair (Pe,Se) for the employed signature scheme such that 
S E (a' A f a rB ) = S A (a rA 9 a rB ) . E then obtains a certificate Cert E for P E> and transmits 
message (3 1 ) to B. 

25 This new UKS attack against the initiator is similar to the public key substitution 

attack against the initiator described above. After B sends message (2), E intercepts it and 
selects a key pair (PE; SE) for the employed signature scheme such that S E 
S E (a rB , a rA ) = S 9 (a rB , a rA ). E then obtains a certificate Cert E for P E , and transmits 
message (2') to A. 
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In the on-line UKS attacks, the adversary knows the private key SE corresponding 
to its chosen public key P E . Hence, unlike the case of public key substitution attacks, the 
on-line attacks cannot be prevented by requiring that entities prove to the certificate- 
5 issuing authority possession of the private keys corresponding to their public keys during 
the certification process. 

The applicants have discovered that the STS protocols have some security 
attributes that are lacking. It is, thus desirable to implement a STS protocol wherein 
unknown key-share attacks are minimized. 

10 

SUMMARY OF THE INVENTION 

According to a general aspect of the invention there is provided in a key agreement 
protocol the steps of including the identities of the sender and intended receiver as well as 
a flow number in the message being signed to thereby prevent an on-line UKS attack. 
1 5 According to one aspect of the invention, there is provided in an STS-MAC 

protocol, including one of the entities A sending its certificate Cert A in a first flow to 
thereby minimize an on-line UKS attack against a responder B. 

According to a further aspect of the invention, there is provided the step of 
implicit, rather than explicit, key confirmation. 
20 A still further aspect of the invention provides for including the identities of the 

entities in the key derivation function, rather than the signed message. 

A further feature of the invention provides for the application thereof to STS-ENC 
and STS-MAC protocols. 

25 BRIEF DESCRIPTION OF THE DRAWINGS 

These and other features of the preferred embodiments of the invention will 
become more apparent in the following detailed description in which reference is made to 
the appended drawings wherein: 

30 Figure 1 is a schematic diagram of a data communication system. 
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DETAILED DESCRIPTION OF A PREFERRED EMBODIMENT 

Referring to figure 1, an electronic communication system 10 includes a pair of 
correspondents, A and B, designated as a sender 12 and recipient 14, connected by a 
communication channel 16. Each of the correspondents 12 and 14 includes an encryption 
unit 18 and 20 respectively that may process information and prepare it for transmission 
through the channel 16. A third entity 22 is depicted as the adversary. 

In a key establishment/agreement protocol, according to the embodiment of the 
present invention, the following flow of messages take place between the entities: 
Item 1. 

(1) A->E A,a rA 

(2) A<r-B Certe, a r \S B (2 y B,A i a rS i a rA ) J MAC K (S 3 (2,B,A,a r \a rA )) 

(3) A^B Cert A , S A {XA y B,a rA ^imC^S A {3,A,B y a r \a rB )) 

In the original STS-MAC protocol described in the background section and the 
modification presented above, the agreed key K is used as the MAC key for the purpose of 
providing explicit key confirmation. A passive adversary now has some information about 
K, namely the MAC of a known message under K. The adversary can use this to 
distinguish K from a key selected uniformly at random from the key space 1. The key 
space here is K = : 1 < / < n - 1}. Another drawback of providing explicit key 
confirmation in this way is that the agreed key K may be subsequently used with a 
different cryptographic primitive than the MAC algorithm | this violates a fundamental 
cryptographic principle that a key should not be used for more than one purpose. 

Two ways of achieving implicit, rather than explicit, key confirmation are : 
(i) derive two keys K \\ K* = H (a rArB ) from the same shared secret (here, H is a 
cryptographic hash function); and 
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(ii) derive two keys K' = H } (a rArB ) and K = H 2 (a rAr * ) where Hi and H 2 are 
independent random oracles 2 . 

K' is used as the MAC key for the session, while K is used as the agreed session key. The 
5 revised protocol is depicted below. 

Item 2. 

0M->£ A,a rA 

(2) A+-B Certs, a rB ,S B (2 t BM,a rB ^a^imC^S^BM^ 8 9 a rA ^ 

10 (3) A->B Cert A , S A {\A*B,a' A ,a*\MAC K . (S A (3, A,B 9 a rA ,a rB )) 

Instead of including the identities of the entities in the signed message, one could 
include them in the key derivation function, whose purpose is to derive the shared key 
from the shared secret a rArB . In the protocol of item 1 , the shared secret key would be 
15 K = H(a rArB 'A,B) , while in the two protocols of item 2, the shared keys would be 
K\\K' = H(a rArB 'A,B)Bnd(ii) K' = H x (a rArBt A,B)znd K' = H 2 (a rArB, A 9 B) 

However, key derivation functions have not been well-studied by the cryptographic 
community the desirable properties of a key derivation function have not yet been 
specified. 

20 Hence the protocols presented in items 1 . and 2. are preferred over the variants 

which include identities in the key derivation function. 

The protocols in item 2 provide implicit key confirmation. While the assurance that 

the other entity has actually computed the shared key K is not provided, each entity does 

get the assurance that the other has computed the shared secret a rArB . Implicit key 
25 confirmation is still provided (to a somewhat lesser degree) if the MACs are not included 

in the flows. The revised protocol is shown below: 

Item 3. 

(1) A^B A,a rA 

(2) A+-B Cert Bt a rB t S B (2,B,A,a rB ,a rA ) 

9 
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(3) A->B Cert A ,S A (3 t A>B,a' A t a' B ) 

The on-line UKS attacks cannot be launched on STS-ENC because the signatures 
S A (a rA ,a rB ) and S 3 (a rB ,a rA ) are not known by the adversary. However, as a 
precautionary measure, we recommend that STS-ENC be modified so that the flow number 
and identities of the sender and intended recipient be included in the signed messages or 
that the identities be included in the key derivation function above. 

Although the invention has been described with reference to certain specific 
embodiments, various modifications thereof will be apparent to those skilled in the art 
without departing from the spirit and scope, of the invention as outlined in the claims 
appended hereto. For example, the items are described with respect to the STS-MAC they 
can equally well be defined with respect to the STS-ENC. Furthermore, they can be 
utilized over other groups such as elliptic curve groups. 
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THE EMBODIMENTS OF THE INVENTION IN WHICH AN EXCLUSIVE 
PROPERTY OR PRIVILEGE IS CLAIMED ARE DEFINED AS FOLLOWS: 

1 . A method of establishing a common shared key between a pair of correspondents, 
said method comprising the steps of exchanging messages between the correspondents and 
including identification information in said messages, said information being identifiable 
to one or other of said correspondents to thereby establish said common key. 

2. A method as substantially herein described. 

3. An apparatus as substantially herein described. 
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